1. Who we are
Oxytal is a digital consultancy with offices in London, Dublin and Chandigarh. This policy explains what we do with personal data collected through this website and in the course of our business.
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the data controller for information collected through this website is:
Our group also includes Oxytal UK Limited (registered in England and Wales, company number 16848238) and Oxytal India Private Limited (CIN: U72900HR2022FTC100829, Panipat, India). Where these entities process personal data they do so under the same standards set out in this policy.
2. What information we collect
Information you give usWhen you complete the contact form on this website, we collect the details you enter:
- Your name — so we know who we're replying to
- Your organisation — optional, and only used to understand the context of your enquiry
- Your work email address — this is how we reply
- Your telephone number — optional, used only if you'd prefer a call
- The service area you selected — so your enquiry reaches the right team
- Your message — whatever you choose to tell us about what you need
- Your consent — a record that you agreed to us using these details to reply, and when
What happens to it. The details you submit are stored in our secure customer relationship database and used by our team to respond to your enquiry and, if a conversation develops, to manage that relationship. A person reads every enquiry. We do not add you to a marketing mailing list on the basis of a contact form submission, and we do not sell or rent your details to anyone.
We also collect information you give us by email, telephone, at events, or in the course of working together — for example the names and contact details of people at a client organisation who are involved in a project.
Information collected automaticallyWhen you visit this website we may collect technical information including your IP address, browser type and version, device type, operating system, the pages you visit and how long you spend on them, and the page or search that referred you. Some of this is collected through cookies and similar technologies — see section 10.
Information from other sourcesWe may receive your business contact details from publicly available professional sources such as a company website or LinkedIn, or from a mutual contact who has introduced us.
3. Why we use your information
We use personal data for the following purposes and no others:
- To respond to your enquiry. Reading what you sent, replying to you, and arranging a call if that's the sensible next step.
- To manage a business relationship. If we start working together, to deliver the work, communicate about it, and handle contracts and invoicing.
- To keep our own records. Maintaining an accurate record of who contacted us and about what, so that a colleague can pick up a conversation and so we don't ask you the same question twice.
- To improve this website. Understanding in aggregate which pages are useful and where people give up.
- To meet legal and regulatory obligations. Including accounting, tax and, where relevant, responding to lawful requests.
- To consider job applications. See section 11.
We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not carry out profiling of website visitors.
4. Our legal basis for using it
Under the GDPR we must have a lawful basis for each purpose. Ours are:
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You can ask us for details of that assessment, and you have the right to object — see section 9.
6. International transfers
We operate from Ireland, the United Kingdom and India, so personal data may be accessed by colleagues in any of those locations. Some of our service providers are also located outside the European Economic Area.
Where personal data is transferred outside the EEA or the UK, we make sure an appropriate safeguard is in place. In practice this means either the destination country has an adequacy decision, or the transfer is covered by Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where the UK GDPR applies), together with any additional measures the circumstances require.
Transfers to our Indian entity are covered by intra-group data transfer arrangements incorporating those clauses. You can request a copy of the relevant safeguards by emailing privacy@oxytal.com.
7. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires.
8. How we protect it
We take security seriously — it's part of what we're hired to build for other people.
- Data is encrypted in transit using TLS, and encrypted at rest in our systems
- Access is limited to colleagues who need it for their role, and controlled by individual accounts with multi-factor authentication
- Our systems are patched and monitored, and access is logged
- Our team receives data protection training, and confidentiality obligations are in every employment and contractor agreement
- We maintain procedures for identifying, containing and reporting personal data breaches
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly where the risk is high.
No system is perfectly secure, and we won't pretend otherwise. What we can commit to is that we take reasonable and appropriate measures, and that we'll tell you promptly if something goes wrong.
9. Your rights
If you are in the EEA or the UK, you have the following rights over your personal data. These are free to exercise, and using them will never disadvantage you.
- Access. Ask for a copy of the personal data we hold about you.
- Rectification. Ask us to correct anything inaccurate or incomplete.
- Erasure. Ask us to delete your data where there's no good reason for us to keep it.
- Restriction. Ask us to pause using your data while a concern is resolved.
- Portability. Ask for the data you gave us in a structured, machine-readable format.
- Objection. Object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent. Where we rely on consent, withdraw it at any time. This doesn't affect anything done before you withdrew it.
How to exercise them. Email privacy@oxytal.com and tell us what you'd like. We'll respond within one month. We may ask you to confirm your identity first — only so we don't disclose your data to somebody else.
If you are in India, you have comparable rights under the Digital Personal Data Protection Act 2023, including access, correction, erasure and grievance redressal. The same email address reaches us.
11. If you apply for a job
Applications are handled through our candidate portal at career.oxyem.io. When you register and apply we collect your name, contact details, CV, work history, and anything else you choose to provide, along with notes and assessments made during the process.
We use this only to assess your application, communicate with you about it, and meet our obligations as an employer. It is shared only with the colleagues involved in hiring for that role.
If your application is unsuccessful we keep your details for [12] months in case a suitable role opens, unless you ask us to delete them sooner. You can ask us to do that at any time by emailing careers@oxytal.com.
12. Data we handle for clients
When we deliver projects, we sometimes process personal data that belongs to our clients — for example during a data migration, or while supporting a system that holds customer records.
In those situations the client is the data controller and Oxytal acts as a data processor. We process that data only on the client's documented instructions, under a written data processing agreement that sets out the subject matter, duration, purpose, security measures and the obligations of both parties.
If your data has been processed by us on behalf of one of our clients, please contact that organisation directly — they control it and are best placed to answer. If you're not sure who to ask, email us and we'll help you find out.
13. Children
This website is intended for business audiences and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy as our business, the technology or the law changes. The version and dates at the top of this page always show when it was last revised.
If we make a change that materially affects how we use your data, we will take reasonable steps to tell you — and where the law requires it, we will ask for your consent again rather than assuming it.
15. Contact and complaints
For any question about this policy or about how we handle your data: